FIN6Threat actor
- atk88
- camouflage tempest
- g0037
- gold franklin
- itg08
- magecart group 6
- skeleton spider
- squid comet
- storm-0538
- ta4557
- taal
- white giant
FIN is a group targeting financial assets including assets able to do financial transaction including PoS.From MISP Galaxy
Last reported 3 months ago, by Recorded Future3 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“… we have shown throughout the article, to execute payloads GrimAgent uses both the ShellExecute call and indirect execution through scheduled tasks.”
- T1036Masquerading
“This variant utilizes a .vbs dropper by masquerading as a .doc file, as Windows still hides the original filename extension by default.”
- T1047Windows Management Instrumentation
“Finally, it examined a popular technique used by adversaries to maintain persistence, Windows Management Instrumentation (WMI) Event Subscription (T1084).”
- T1053Scheduled Task/Job
“In this post, we’ll explore two additional persistence techniques that are being used by attackers in the wild: Scheduled Tasks (T1053) and BITS Jobs (T1197).”
- T1197BITS Jobs
“…we’ll explore two additional persistence techniques that are being used by attackers in the wild: Scheduled Tasks (T1053) and BITS Jobs (T1197).”
- T1552.004Private Keys
“Generated client RSA public and private keys: Both stored at the config file.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
TAG-195 Upgrades MaaS Ecosystem with Modular Tools“Public reporting by eSentire has previously linked TAG-195 tooling to FIN6, Cobalt Group, and Evilnum, three financially motivated criminal groups, suggesting the ecosystem serves a select customer base; however, details on sales models and access conditions remain unknown.”
-
Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2)“Threat actors like APT34, APT29, and FIN6 have been known to use scheduled tasks as a means to persist.”
-
The Brothers Grim“Later on, it was attributed to two threat actors, FIN6 and Wizard Spider.”
Indicators in its reports
named in the reports above- hxxps://raw.githubusercontent[.]com/3gstudent/SCTPersistence/master/calc.sctin 1 report
- 03ec9000b493c716…88c6a1c65ce5in 1 report
- 015e5a1fa9d8151ee51d6e53e187fbb2in 1 report
- 163917ced2d1b330…ec3ea871d517in 1 report
- 63bd614434a70599…a3c4b4db5cafin 1 report
- hxxps://github[.]com/apriegob/GrimAgent/blob/main/IDAPro/IDAPro_string_decryptor.pyin 1 report
- d6ee553f52f20127…73144ef2354din 1 report
- hxxp://ip-api[.]com/csv/?fields=query,countryCodein 1 report
- microsoftupdate[.]topin 1 report
- microsoftsystemcloud[.]comin 1 report
- chaseltd[.]topin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.